[LunaUrsa]

The previous production build inherited development tooling, repeated dependency installation and Prisma generation, and admitted local secrets into its build context. Separate the build stages, cache npm downloads, prune development dependencies, and copy only runtime files.

Keep Node 22 and Debian Bookworm consistent across stages, pin PM2, install OpenSSL explicitly, and run production as the node user with writable runtime assets. Preserve startup migrations and command registration behavior.

Validation:

• Development and production Docker targets built successfully.
• Isolated container smoke test passed: non-root UID, native modules and Prisma clients, excluded local secrets/test dependencies, and writable runtime data.
• TypeScript, targeted ESLint, and git diff --check passed.
• Added an opt-in Vitest smoke test enabled with TRIPBOT_TEST_IMAGE=tripbot:docker-review.

The visible production filesystem is about 930 MiB, including 594 MiB of dependencies. Prisma CLI remains for startup migrations. No bot startup or database migrations were performed.